Privacy Notice

Updated 20 July 2026.

1. Introduction

This Privacy Notice (“Notice”) explains how KPF and its associated companies (together referred to as “KPF”, “we”, “us”, or “our”) collect, use, disclose, store, and protect personal data.

KPF is committed to protecting personal data and complying with applicable data protection and privacy laws in all jurisdictions in which we operate.

This Notice applies to personal data collected online (including via our website) and offline during our business activities.

2. Who We Are (Data Controller)

KPF and its associated group companies act as data controllers in respect of the personal data described in this Notice. The relevant controller depends on your relationship with KPF (e.g. client, supplier, applicant).

Contact Details
Email: privacy@kpf.com
Website: www.kpf.com

Where required by law, KPF will appoint and maintain appropriate data protection representatives.

3. Data Protection Legislation

KPF complies with applicable data protection and privacy legislation, including where relevant:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations (PECR)
• Data (Use and Access) Act 2025
• EU General Data Protection Regulation (EU GDPR), where applicable
• Other local data protection laws in jurisdictions where we operate

4. Who We Collect Personal Data From

We process personal data relating to:

• Visitors to our Website
• Representatives of prospective and existing clients
• Representatives of suppliers and business partners
• Employment applicants
• KPF employees, consultants and other personnel where their personal data is used for business, marketing, communications, photography, project, or internal administration purposes

5. Personal Data We Collect

Website Visitors

We may collect personal data when you:

• Submit an enquiry via website forms
• Contact us by email

This may include, Name, Email Address, Telephone Number, Organization. We also collect technical and usage data via cookies (please refer to our cookie policy) and similar technologies such as:

• IP address
• Browser type and version
• Device information
• Pages visited and time spent
• Referral source

We also collect technical and usage data via cookies, tracking technologies, analytics tools and similar technologies such as:

• IP address
• Browser type and version
• Device information
• Pages visited and time spent
• Referral source
• Interaction with website content, forms, downloads, emails or marketing pages

KPF uses HubSpot for customer relationship management, marketing, website forms, marketing communications, and website analytics/tracking. Where HubSpot tracking code is used on our website, it may collect information about website visits, interactions with pages, form submissions, email engagement, and related marketing activity. This is used to help KPF understand engagement with its website and communications, manage client and prospective client relationships, respond to enquiries, and improve our communications and services.

The use of HubSpot tracking code and related cookies or similar technologies should be read together with KPF’s Cookie Notice, which explains the cookies and tracking technologies used on our website, their purposes, and how users can manage their cookie preferences.

Aggregate and anonymized data may also be collected for analytics purposes.

Social Media Channels

KPF may process personal data when you interact with KPF’s social media channels or content, including where you:

• Follow, like, comment on, share, or otherwise interact with KPF content
• Send KPF direct messages or enquiries through social media platforms
• Participate in campaigns, events, announcements or other online engagement

This may include:

• Name and public profile details
• Username or handle
• Comments, reactions, messages and other interactions
• Images, video or other content you provide or consent to being used
• Professional role, organisation or business contact information where relevant

KPF does not control the privacy practices of third-party social media platforms. Your use of those platforms is subject to the privacy notices and terms of the relevant platform.

Representatives of Prospective & Existing Clients

We process business contact data to manage our relationship with you, including:

• Name
• Job Title
• Company Name & Address
• Telephone Number
• Email Address

We may collect this data when you:

• Enter a contract with us
• Contact us with enquiries or complaints
• Attend meetings or events
• Subscribe to newsletters or communications
• Engage with KPF marketing, business development or client relationship activities
• Interact with KPF website forms, email campaigns, event invitations or other HubSpot-supported communications

Client and prospective client data may be stored or managed in KPF’s customer relationship management and marketing systems, including HubSpot, for purposes such as client relationship management, business development, event management, marketing communications, contact preference management, and responding to enquiries.

Representative of Suppliers & Business Partners

We process personal data to manage supplier and partner relationships, including:

• Name
• Job title
• Company name and address
• Telephone number

This data may be collected during contracting, project engagement, events, or communications.

Employment Applications

When you apply for a KPF role we may process:

• Name
• Home Address
• Telephone Number
• Email Address
• Education & Employment History
• CV & Supporting Documents

Additional data may be collected during recruitment, including interview notes and references. Where necessary, we may process special category data (e.g. health or disability information) solely for recruitment-related purposes such as reasonable accommodation, and only in accordance with applicable law. Subject to your consent, we may retain your personal data for a period of up to six (6) months following your application submission to consider you for future employment opportunities.

Where you progress to the interview stage, your personal data may be retained for a longer period of up to twelve (12) months from the date of your last interaction with us, in order to manage the recruitment process, maintain records, and consider you for suitable roles that may arise.

You may withdraw your consent at any time and request the deletion of your personal data in accordance with applicable data protection laws.

Employee Images, Marketing Materials and OpenAsset Facial Recognition

KPF may process employee images, photographs, video recordings, names, job titles, office location, project role, professional biography and related information for legitimate business, marketing, communications, internal knowledge management, project, recruitment, employer branding and archival purposes.

KPF may use photographs or video footage of employees in marketing materials, website content, social media posts, event communications, internal communications, project materials, awards submissions, publications, presentations and other business communications. Where required, KPF will rely on consent to feature employees in specific marketing materials or social media posts. KPF uses OpenAsset to manage image libraries and identify employees in photographs. OpenAsset facial recognition functionality may be used to help identify KPF employees in images and support image management, tagging, search, marketing, project and communications activities.

The use of OpenAsset facial recognition has been reviewed for GDPR compliance. Employees may opt out of facial recognition identification or request that they are not identified in OpenAsset in accordance with KPF’s internal process. Where an employee opts out, KPF will take reasonable steps to reflect this preference in OpenAsset and related workflows.

Where facial recognition data is processed in a manner that qualifies as biometric data under applicable data protection law, KPF will process such data only where it has an appropriate lawful basis and, where required, an applicable condition for processing special category data, such as explicit consent or another lawful basis permitted by applicable law.

6. Sources of Personal Data

Personal data is collected:

• Directly from you
• From your employer or organization
• From publicly available sources (e.g. professional networking sites)
• From recruitment agencies (for applicants)
• From your interactions with our website, cookies, forms, marketing communications, HubSpot tracking code and similar technologies
• From social media platforms where you interact with KPF content or channels
• From KPF employees, project teams, event organisers, photographers, marketing teams, communications teams or approved systems such as OpenAsset, where photographs or marketing materials are created or managed

We will process personal data of employment applicants when you apply for a position with KPF. This includes but is not limited to; Name, Home Address, Contact Telephone Numbers, Email Address, Education and Employment History.

7. Whether You Must Provide Personal Data

In some cases, providing personal data is:

• Contractual (e.g. client or supplier engagement)
• Necessary to take steps prior to entering a contract
• Required to process an employment application
• Necessary to respond to website, social media, client, supplier, marketing or business enquiries

Failure to provide required data may prevent us from responding to enquiries, entering into contracts, progressing applications, managing communications, or providing relevant business updates.

Where processing is based on consent, such as certain marketing communications, employee features in marketing materials, or certain uses of facial recognition where consent is required, you may withdraw your consent at any time.

8. How We Use Personal Data & Legal Basis

Lawful Bases for Processing: We process personal data under one or more of the following lawful bases:

• Consent
• Performance of a contract
• Legal obligation
• Legitimate interests, provided these do not override your rights

Purposes and Legal Bases

• Responding to enquiries and complaints: legitimate interests
• Managing client and supplier relationships: contract / legitimate interests
• Recruitment and selection: contract steps / legitimate interests
• Legal and regulatory compliance: legal obligation
• Marketing communications: consent or legitimate interests (where permitted)
• Website analytics and improvement: consent (where required)
• Featuring employees in marketing materials, website content, social media posts, publications, presentations or event communications: consent where required / legitimate interests where permitted
• Managing social media enquiries, interactions and KPF social media channels: legitimate interests / consent where required
• HubSpot CRM, website tracking, forms, marketing communications and contact preference management: consent or legitimate interests, depending on the activity and applicable law
• Managing employee image libraries and using OpenAsset to identify employees in photographs: legitimate interests / consent or explicit consent where required

Where we rely on legitimate interests, these include operating a lawful business, maintaining relationships, improving services, managing client and prospective client communications, managing marketing and business development activities, maintaining accurate contact preferences, managing professional image libraries, supporting communications and social media activities, and ensuring network and information security.

9. Marketing Communications

You may receive marketing communications where permitted by law. You can opt out at any time by:

• Using unsubscribe links included in marketing emailsContacting us at privacy@kpf.com
• Contacting press@kpf.com or info@kpf.com
• Responding to the relevant communication and asking to be removed from future marketing communications

For email marketing, KPF includes unsubscribe links where required and uses suppression lists to ensure marketing preferences are respected.

For postal marketing or other non-email communications, you may contact us using the details above and ask not to receive further marketing communications by mail or other channels.

We maintain suppression lists to ensure marketing preferences are respected. Suppression lists are used only to record and manage opt-out preferences and to ensure individuals who have unsubscribed or objected to direct marketing are not contacted for marketing purposes.

10. Disclosure of Personal Data

We may share personal data with:

• KPF group companies and affiliates
• Trusted third-party service providers acting on our instructions
• Professional advisers (e.g. legal, auditors)
• Authorities where required by law
• Parties involved in mergers, acquisitions, or business transfers
• CRM, marketing, website analytics, event and communication service providers, including HubSpot where used
• Image library, digital asset management, photography, marketing or communications service providers, including OpenAsset where used
• Social media platforms where you interact with KPF social media channels or where KPF publishes approved content

All third parties are required to protect personal data in accordance with applicable laws. Where third-party service providers process personal data on KPF’s behalf, KPF takes appropriate steps to ensure that contractual, technical and organisational safeguards are in place.

11. International Transfers

KPF operates internationally, and your personal data may be transferred to, stored in, or accessed from countries outside your country of residence. Some of these countries may have different data protection laws. We may also make other disclosures of your personal data overseas, for example if we receive a legal or regulatory request from a foreign law enforcement body. Where this is the case, we take steps to ensure your personal data is protected, including:

• Transferring data to countries recognized as providing an adequate level of protection
• Using approved contractual safeguards, such as Standard Contractual Clauses or the UK International Data Transfer Agreement
• Applying internal group data transfer agreements
• Carefully reviewing and responding to requests from foreign authorities

Where KPF uses third-party service providers such as HubSpot, OpenAsset or other cloud-based systems, personal data may be processed in or accessed from jurisdictions outside your country of residence. KPF will take appropriate steps to ensure that such transfers are protected in accordance with applicable data protection laws.

You can contact us for more information about international transfers and the safeguards we use.

12. How We Protect & Store Your Information

We take the security of your personal data seriously and use appropriate technical and organisational measures to protect it. These measures include:

• Restricting access to personal data to authorized individuals
• Using secure IT systems and networks
• Applying encryption where appropriate
• Monitoring systems for security incidents
• Requiring staff and service providers to maintain confidentiality
• Securely deleting or anonymizing personal data when it is no longer needed
• Managing access to CRM, marketing, website analytics and digital asset management systems on a need-to-know basis
• Applying appropriate controls to employee photographs, marketing materials, image libraries and facial recognition functionality where used
• Respecting employee opt-out requests relating to OpenAsset facial recognition identification

13. How Long We Keep Your Personal Data

We keep personal data only for as long as necessary for the purposes for which it was collected. Retention periods may vary depending on the nature of the data and legal requirements, for example:

• Website enquiries: up to 12 months
• Client and supplier contact details: for the duration of the relationship and up to 7 years afterwards
• Recruitment data: retained for up to 12 months where the candidate has been interviewed, and up to 6 months when no interview has taken place. Legal, tax, and accounting records: as required by law
• Marketing contact records and HubSpot CRM records: for as long as necessary to manage the business relationship, marketing preferences, enquiries, events, communications and suppression lists, unless a longer retention period is required by law or necessary for legitimate business purposes
• Marketing opt-out and suppression records: retained for as long as necessary to ensure that opt-out preferences are respected
• Employee photographs, image libraries and marketing materials: retained for as long as necessary for the relevant business, marketing, project, archival, legal or communications purpose, unless a shorter period applies or a valid objection, withdrawal of consent, opt-out or deletion request applies
• OpenAsset facial recognition identification data: retained only for as long as necessary for the relevant image management purpose and subject to employee opt-out rights and applicable legal requirements

Once personal data is no longer required, it is securely deleted or anonymized.

14. Links to Other Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to review their privacy notices before providing personal data.

15. Your Rights

You have a number of rights in relation to your personal data, subject to applicable law. These include the right to:

• Access your personal data
• Correct inaccurate or incomplete data
• Request deletion of your personal data
• Restrict or object to processing
• Withdraw consent where processing is based on consent
• Request the transfer of your personal data
• Object to the use of your data for direct marketing
• Lodge a complaint with a data protection authority/local supervisory authority

We may ask you for additional information to confirm your identity and for security purposes, before disclosing the personal data requested by you. We reserve the right to charge a fee where permitted by law, for instance if your request is manifestly unfounded or excessive.

You can exercise your rights by contacting us. We will make every reasonable effort to honour your request promptly or inform you if we require further information in order to fulfil your request.

We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.

16. Notification of Changes

We may update this Privacy Notice from time to time. Any changes will be posted on our website. Where changes are significant, we will take reasonable steps to bring them to your attention.

17. Automated Decision-Making

We do not use automated decision-making or profiling that has legal or similarly significant effects on individuals. However, KPF’s use of OpenAsset facial recognition is intended to support employee image identification, image library management, marketing, communications and project-related workflows. It is not used to make decisions that have legal or similarly significant effects on individuals.

18. Contact Us

If you have any questions about this Privacy Notice or how we handle your personal data, or if you wish to exercise your rights, please contact:

• Email: privacy@kpf.com
• Marketing opt-out enquiries may also be sent to press@kpf.com or info@kpf.com